CVE-2024-6911 Overview
CVE-2024-6911 is a local file inclusion (LFI) vulnerability in PerkinElmer ProcessPlus affecting versions up to and including 1.11.6507.0. The flaw allows unauthenticated remote attackers to read arbitrary files from the underlying Windows host. Because no credentials are required and the attack vector is network-based, exposure of any ProcessPlus instance over a reachable interface can leak operating system, configuration, and application data. The weakness is categorized as [CWE-552] Files or Directories Accessible to External Parties.
Critical Impact
Unauthenticated network attackers can retrieve sensitive Windows files, including credentials, configuration data, and application secrets, without leaving authentication artifacts.
Affected Products
- PerkinElmer ProcessPlus through version 1.11.6507.0
- Windows hosts running the ProcessPlus web component
- Industrial process environments using ProcessPlus for data acquisition
Discovery Timeline
- 2024-07-22 - CVE-2024-6911 published to NVD
- 2024-11-21 - Last updated in NVD database
Technical Details for CVE-2024-6911
Vulnerability Analysis
The vulnerability stems from how PerkinElmer ProcessPlus handles file path parameters supplied through its web-facing component. The application resolves user-controlled input into local file system paths without enforcing access boundaries or authentication. An attacker can craft HTTP requests that traverse to arbitrary locations on the Windows host and retrieve their contents. The CyberDanube Vulnerability Report documents this as one of several flaws disclosed in the product.
Local file inclusion in industrial software is high-value to attackers. ProcessPlus deployments often reside in operational technology (OT) zones where stored credentials, database connection strings, and recipe files reveal pathways for lateral movement. The EPSS probability of 4.944% places this issue in the 91st percentile for likely exploitation activity.
Root Cause
The root cause is missing authentication and missing path normalization on a file-serving endpoint. Requests containing relative path sequences are passed to file read routines without canonicalization, allowing references outside the intended web directory. The component does not require any session token or credential before returning file contents.
Attack Vector
An unauthenticated attacker reachable over the network sends an HTTP request to the vulnerable ProcessPlus endpoint with a manipulated path parameter. The server reads the targeted file from the Windows file system and returns its contents in the HTTP response. No user interaction is required. The Full Disclosure Mailing List advisory describes the disclosure context.
The vulnerability is described in prose only because no verified public proof-of-concept code is referenced in the advisories.
Detection Methods for CVE-2024-6911
Indicators of Compromise
- HTTP requests to ProcessPlus endpoints containing path traversal sequences such as ..\, ..%2f, or %2e%2e%5c.
- Requests referencing sensitive Windows paths including C:\Windows\win.ini, C:\Windows\System32\drivers\etc\hosts, or ProcessPlus configuration files.
- Outbound responses from the ProcessPlus host containing file contents not normally served by the web component.
Detection Strategies
- Inspect web server and reverse proxy logs for repeated 200 responses to ProcessPlus URLs containing encoded traversal patterns.
- Correlate process telemetry on the ProcessPlus Windows host to flag the service process reading files outside its installation directory.
- Apply network signatures that match LFI payloads targeting the ProcessPlus HTTP port observed in your environment.
Monitoring Recommendations
- Forward ProcessPlus host logs, IIS logs, and EDR file-access telemetry to a central analytics platform for correlation.
- Alert on unauthenticated access to ProcessPlus endpoints from segments that should not reach OT systems.
- Baseline normal file access patterns of the ProcessPlus service account and alert on deviations such as reads of credential stores or SAM registry hives.
How to Mitigate CVE-2024-6911
Immediate Actions Required
- Restrict network reachability of ProcessPlus to authorized engineering workstations using firewall rules or network segmentation.
- Place the ProcessPlus web interface behind an authenticating reverse proxy that blocks path traversal patterns.
- Audit the ProcessPlus host for evidence of prior file disclosure by reviewing web access logs going back to mid-2024.
Patch Information
No vendor advisory URL is listed in the NVD entry. Operators should contact PerkinElmer support directly to confirm whether a fixed build beyond 1.11.6507.0 is available and request remediation guidance. Until a patched version is deployed, compensating controls are required.
Workarounds
- Block external and non-OT network access to the ProcessPlus HTTP service at the perimeter and internal firewalls.
- Deploy a web application firewall rule that rejects requests containing ..\, ../, or their URL-encoded variants against ProcessPlus URLs.
- Run the ProcessPlus service under a least-privilege Windows account that cannot read sensitive system files or credential stores.
# Example WAF rule (ModSecurity) to block traversal against ProcessPlus
SecRule REQUEST_URI "@rx (\.\./|\.\.\\|%2e%2e%2f|%2e%2e%5c)" \
"id:1006911,phase:1,deny,status:403,\
msg:'CVE-2024-6911 ProcessPlus LFI attempt blocked'"
Disclaimer: This content was generated using AI. While we strive for accuracy, please verify critical information with official sources.
